Application security policies should be reviewed by a domain expert at the application-architecture level to ensure best practices are followed.

CAST supports the application/security architect by providing information about application structure, allowing the definition of custom rules using architecture checker, and the tracking and control of these rules in subsequent application development.

Sensitive cryptography routines should be reviewed by a domain expert at the application-architecture level to ensure best practices are followed.

CAST supports the application/security architect by providing information about application structure, allowing the definition of custom rules using architecture checker, and the tracking and control of these rules in subsequent application development.

A complete inventory of the third parties (libraries, frameworks and tools) used by a project should be in place. Versions should be kept up-to-date, and current versions should be monitored for security weaknesses announcements.

These vulnerabilities are not possible to find using static analysis. CAST has integrations with vendors in the SCA space who track known vulnerabilities, to display them alongside CAST AIP findings.

[1]

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Checking for SQL Injection by

Pre-built rule in AIP – 2663 - Avoid SQL injection vulnerabilities

[2]

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Checking for OS Command Injection

Pre-built rule in AIP – 2661 - Avoid OS command injection vulnerabilities

[4]

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Checking for Cross-site scripting

Pre-built rule in AIP – 2284 - Avoid cross-site scripting vulnerabilities

[9]

CWE-434

Unrestricted Upload of File with Dangerous Type

Input Validation

In CAST AIP 8.0, we trigger this rule via PATH Manipulation. Extend the following existing rules –

• 2437 - Avoid non-standard file extensions
• 2659 - Avoid file path manipulation vulnerabilities

• 2660 - Avoid XPath injection vulnerabilities

[12]

CWE-352

Cross-Site Request Forgery (CSRF)

Ensure that application is free of cross-site scripting issues (CWE-79), because most CSRF defences can be bypassed using attacker-controlled script.

Pre-built rule in AIP – 2284 - Avoid cross-site scripting vulnerabilities

[22]

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Checking for Cross-site scripting

Pre-built rule in AIP – 2284 - Avoid cross-site scripting vulnerabilities

[3]

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.

This rule is handled through a combination of existing quality rules around memory handling listed below –

• 2282 - Avoid using getopt() function,
• 2327 - Never use sprintf() function or vsprintf() function
• Never perform C cast between incompatible class pointers

• 2413 - Avoid using static_cast on class/struct pointers

[13]

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Checking for file path manipulation

Pre-built rule in AIP – 2659 - Avoid file path manipulation vulnerabilities

[14]

CWE-494

Download of Code Without Integrity Check

Check Download Code Integrity

We manage this using Input Validation approach –

• 2437 - Avoid non-standard file extensions
• 2659 - Avoid file path manipulation vulnerabilities

• 2660 - Avoid XPath injection vulnerabilities

[16]

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numericIDs) to the actual filenames or URLs, and reject all other inputs.

This is handled by checking every internet library for vulnerability and maintaining a whitelist. Normally we can check the HTML code and parse the URL to verify the domain.

Extend the existing rule 2660 - Avoid XPath injection vulnerabilities

[18]

CWE-676

Use of Potentially Dangerous Function

Checking for programming best practices

Pre-built rule in AIP –

• 2279 - Avoid using snprintf() function
• 2280 - Avoid using realpath() function

• 2325 - Avoid using the scanf() function

[20]

CWE-131

Incorrect Calculation of Buffer Size

Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.

This is handled through a combination of existing quality rules listed below:

• 2327 - Never use sprintf() function or vsprintf() function
• Never perform C cast between incompatible class pointers

• 2413 - Avoid using static_cast on class/struct pointers

[23]

CWE-134

Uncontrolled Format String

Checking for programming best practices

Checking for programming best practices

Pre-built in CAST AIP rule. Extend the following existing rules –

• 8098 - Uncontrolled format string

[24]

CWE-190

Integer Overflow or Wraparound

Perform check on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.

These rules require using DF with Arithmetics. This will be handled by extending the existing rule, 2282 - Avoid using getopt() function

[5]

CWE-306

Missing Authentication for Critical Function

avoid implementing custom authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment.

This requirement is achieved using DF and User input security and extending existing rules –

• 2284 - Avoid cross-site scripting vulnerabilities,

• 2662 - Avoid LDAP injection vulnerabilities

[6]

CWE-862

Missing Authorization

Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

This requirement is achieved using DF and User input security and extending existing rules –

• 2284 - Avoid cross-site scripting vulnerabilities

• 2662 - Avoid LDAP injection vulnerabilities

[8]

CWE-311

Missing Encryption of Sensitive Data

Periodically ensure that you aren't using obsolete cryptography. Avoid using old encryption techniques using MD4, MD5, SHA1, DES, and other algorithms that were once regarded as strong.

Checking of encryption can be handled using custom rules that check for the use of known encryption functions and/or libraries -

• 2284 - Avoid cross-site scripting vulnerabilities

• 2662 - Avoid LDAP injection vulnerabilities

[10]

CWE-807

Reliance on Untrusted Inputs in a Security Decision

Consider getcookies as unsafe

Pre-built rule in AIP – 2284 - Avoid cross-site scripting vulnerabilities

[11]

CWE-250

Execution with Unnecessary Privileges

Checking for privileges being appropriately implemented based on the scenario/use case. Perform extensive input validation and canonicalization to minimize the chances of introducing a separate vulnerability.

This is more linked to dynamic analysis and not directly handled by CAST AIP today. We can extend existing rules to cover part of this requirement –

• 2284 - Avoid cross-site scripting vulnerabilities

• 2662 - Avoid LDAP injection vulnerabilities

[15]

CWE-863

Incorrect Authorization

Consider getcookies as unsafe

Pre-built rule in AIP – 2284 - Avoid cross-site scripting vulnerabilities

[17]

CWE-732

Incorrect Permission Assignment for Critical Resource

Path manipulation

Pre-built rule in AIP – 2659 - Avoid file path manipulation vulnerabilities

[19]

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

Validating encryption algorithms

This will be addressed by creating a blacklist of functions considered risky or broken (Handle via maintaining blacklist of well known and crypto algorithms) and applying custom architectural rules to check for the use of appropriate functions.

[21]

CWE-307

Improper Restriction of Excessive Authentication Attempts

Check login implementation

This will be handled by extending the following existing rules –

• 521 - Avoid direct access to database Procedures/Functions

• 750 - User Interface elements must not use directly the database|

[25]

CWE-759

Use of a One-Way Hash without a Salt

Checking for programming best practices. Best practice, always use initialises that contain salt for Hash. Instead of calling Hashlib with just one parameter use additional parameters for salt.

This will be addressed by blacklisting methods that do not contain the good initialization parameters. Extend the following existing rules –

• 2785 - Avoid using Hashtable

• 1035 - Avoid classes overriding only equals() or only hashCode()

CWE-20:

Improper Input Validation

Checking for best programming practices

Pre-built rule in AIP –

• 2663 - Avoid SQL injection vulnerabilities
• 2660 - Avoid XPath injection vulnerabilities

• 2284 - Avoid cross-site scripting vulnerabilities

CWE-116:

Improper Encoding or Escaping of Output

Checking for best programming practices

Pre-built rule in AIP –

• 2663 - Avoid SQL injection vulnerabilities
• 2661- Avoid OS command injection vulnerabilities

• 2284 - Avoid cross-site scripting vulnerabilities

CWE-90

LDAP Injection

Checking for LDAP injection

Pre-built rule in AIP – 2662 - Avoid LDAP injection vulnerabilities

CWE-91

XPATH Injection

Checking for XPATH injection

Pre-built rule in AIP – 2660 - Avoid XPath injection vulnerabilities

CWE-73:

External Control of File Name or Path

Checking for file path manipulation

Pre-built rule in AIP – 2659 - Avoid file path manipulation vulnerabilities

CWE-99:

Improper Control of Resource Identifiers ('Resource Injection')

Checking for best programming practices

Pre-built rule in AIP – 2659 - Avoid file path manipulation vulnerabilities

CWE-117:

Improper Output Neutralization for Logs

Checking for log forging

Pre-built rule in AIP – 2141 - Avoid Log forging vulnerabilities

CWE-252:

The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Checking the return value of the function will typically be sufficient, however beware of race conditions (CWE-362) in a concurrent environment.

Supported from CAST AIP 8.0 onwards

CWE-681:

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values.

Avoid making conversion between numeric types. Always check for the allowed ranges.

Supported from CAST AIP 8.0 onwards

6.2 Establish a process to identify and assign a risk ranking to newly discovered security vulnerabilities.

CAST AIP can be seamlessly integrated into the existing development process either at the build phase or before testing phase.

CAST AIP also automatically assigns ranks to the vulnerabilities through a combination of vulnerability severity, determined by industry standards, and the risk the specific vulnerability presents to the application as a whole (though propagation risk analysis and transaction risk analysis)

In addition to identifying the vulnerability, CAST AIP also provides detailed guidance on how to fix the vulnerability with sample code.

6.3 Develop software applications (internal and external, and including web-based administrative access to applications) in accordance with PCI DSS (for example, secure authentication and logging), and based on industry best practices, and incorporate information security throughout the software development life cycle.
6.3.2 Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability.

CAST AIP out of the box includes more than 300 security best practices that cover over 50 programming languages with AIP extensions. Also, CAST AIP can be integrated into the SDLC to automate the process of code analysis to identify these vulnerabilities.

CAST AIP also provides additional tools like "Architecture Checker" to create custom rules unique to specific applications.

6.4 Follow change control processes and procedures for all changes to system components.

CAST Discovery Portal, creates an automatic blue print of the entire system dependencies and also specifically identifies the code added, modified and deleted. This information can expedite the process of following change control procedures.

6.5 Develop applications based on secure coding guidelines and review custom application code to identify coding vulnerabilities. Follow up-to-date industry best practices to identify and manage vulnerabilities (i.e., the OWASP Guide, SANS CWE Top 25, CERT Secure Coding, etc.). The current best practices must be used for these requirements.
6.5.1 Injection flaws, particularly SQL injection. 6.5.2 buffer overflow
6.5.3 Insecure cryptographic storage
6.5.4 Insecure communications
6.5.5 Improper error handling
6.5.6 All "high" vulnerabilities identified in the vulnerability-identification process (as defined in PCI DSS Requirement 6.2).
6.5.7 Cross-site scripting (XSS)
6.5.8 Improper Access Control (such as insecure direct object references, failure to restrict URL access and directory
traversal).
6.5.9 Cross-site request forgery (CSRF)

CAST AIP addresses most of these requirements.
Please see CAST AIP coverage of OWASP and CWE Top 25.

6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes

CAST AIP provides the most comprehensive static analysis automated application vulnerability security assessment tool.

11.2.1 Perform quarterly internal vulnerability scans.
11.2.3 Perform internal and external scans
after any significant change.

CAST AIP configured to automatically run at a regular interval or after any changes to the system.